Loading npm security reports…

@kingingwang/grok@1.0.6-97098a6: AI-agent control-surface risk | LPM Firewall

registry / @kingingwang/grok / 1.0.6-97098a6

@kingingwang/grok@1.0.6-97098a6

Bring Grok into your terminal

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs a sibling-package binary and rewrites Grok's default user control directory. The package identity conflicts with the README's stated official package.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or update

Impact

An unconsented third-party package can replace the executable and configuration used by the Grok CLI.

Mechanism

postinstall binary deployment and ~/.grok config mutation

Policy narrative

Installing this non-officially scoped package automatically creates the default Grok home, writes a decompressed platform payload as ~/.grok/bin/grok, and updates ~/.grok/config.toml. Because the README itself identifies @xai-official/grok as the official npm package, this is an unconsented foreign package mutating a shared AI CLI control surface during postinstall.

Rationale

The install hook mutates the user-wide Grok binary and config without an explicit command, while the package's README points users to a different official scope. This is a concrete foreign AI-agent control-surface takeover pattern despite no direct network logic in the JavaScript.

Evidence

package.jsonbin/postinstall.jsREADME.md~/.grok/bin/grok~/.grok/config.toml

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "postinstall": "node bin/postinstall.js" }

High

Suspicious Lifecycle Evidence

Install lifecycle runs a local postinstall script.

package.jsonView on unpkg · L21

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @shuv1337/shuvgrok@1.0.5 matchedPath = bin/postinstall.js matchedIdentity = npm:QHNodXYxMzM3L3NodXZncm9r:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 910c1c41e996f4e3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @shuv1337/shuvgrok@1.0.5 matchedPath = bin/postinstall.js matchedIdentity = npm:QHNodXYxMzM3L3NodXZncm9r:1.0.5 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.jsView on unpkg

26const GROK_HOME = process.env.GROK_HOME ?? defaultGrokHome(); const CANONICAL_DIR = path.join(GROK_HOME, 'bin');

High

Suspicious Lifecycle Evidence

Postinstall writes a platform payload into the default ~/.grok/bin control directory.

bin/postinstall.jsView on unpkg · L26

66fs.mkdirSync(CANONICAL_DIR, { recursive: true }); function writeVendorBinary(brPath, rawPath, destPath) { const tmp = destPath + `.tmp.${process.pid}`; try { if (fs.existsSync(brPath)) { fs.writeFileSync(tmp, zlib.brotliDecompressSync(fs.readFileSync(brPath))); } else if (fs.existsSync(rawPath)) { fs.copyFileSync(rawPath, tmp); } else { return false; } if (!IS_WINDOWS) fs.chmodSync(tmp, 0o755); fs.renameSync(tmp, destPath);

High

Suspicious Lifecycle Evidence

Postinstall writes a platform payload into the default ~/.grok/bin control directory.

bin/postinstall.jsView on unpkg · L66

193// Write installer config const configDir = GROK_HOME; const configPath = path.join(configDir, 'config.toml'); let obj = {}; try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { } obj.cli ??= {}; obj.cli.installer = 'npm'; // Persist the npm registry so `grok update` and the trampoline use the same one. const npmRegistry = process.env.GROK_NPM_REGISTRY || (() => { try { const resolved = execSync( 'npm config get @kingingwang:registry', { encoding: 'utf8', timeout: 5000 } ).trim(); if (resolved &&

High

Suspicious Lifecycle Evidence

Postinstall modifies ~/.grok/config.toml without user action.

bin/postinstall.jsView on unpkg · L193

bin/grokView file

•matchType = normalized_sha256 matchedPackage = @shuv1337/shuvgrok@1.0.5 matchedPath = bin/shuvgrok matchedIdentity = npm:QHNodXYxMzM3L3NodXZncm9r:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grokView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-42json

1{

2 "name": "@kingingwang/grok",

3 "version": "1.0.6-97098a6",

4 "description": "Bring Grok into your terminal",

5 "license": "Apache-2.0",

6 "bin": {

7 "grok": "bin/grok"

8 },

9 "files": [

10 "bin/"

11 ],

12 "os": [

13 "darwin",

14 "linux",

15 "win32"

16 ],

17 "cpu": [

18 "arm64",

19 "x64"

20 ],

21 "scripts": {

22 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

High

Suspicious Lifecycle Evidence

Install lifecycle runs a local postinstall script.

package.jsonView on unpkg · L21

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=20"

29 },

30 "dependencies": {

31 "@iarna/toml": "^3.0.0"

32 },

33 "optionalDependencies": {

34 "@kingingwang/grok-darwin-arm64": "1.0.6-97098a6",

35 "@kingingwang/grok-darwin-x64": "1.0.6-97098a6",

36 "@kingingwang/grok-linux-arm64": "1.0.6-97098a6",

37 "@kingingwang/grok-linux-x64": "1.0.6-97098a6",

38 "@kingingwang/grok-win32-arm64": "1.0.6-97098a6",

39 "@kingingwang/grok-win32-x64": "1.0.6-97098a6"

40 }

41}

42

bin/postinstall.jsView file

Lines 6-86javascript

6// Unix: grok-<version> + grok (symlink)

7// Windows: grok-<version>.exe + grok.exe (copy)

8//

9// Versioned files ensure running processes are never disrupted on macOS

10// (replacing a binary that a running process has mmap'd causes SIGKILL

11// because the kernel can no longer verify the code signature).

12const path = require('path');

bin/grokView file

•matchType = normalized_sha256 matchedPackage = @shuv1337/shuvgrok@1.0.5 matchedPath = bin/shuvgrok matchedIdentity = npm:QHNodXYxMzM3L3NodXZncm9r:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grokView on unpkg